A new analysis from the Rhodium Group, titled "Car Trouble: ICTS Rule Rewires Global Auto Supply Chains," argues that the U.S. connected-vehicle security rule is doing more than blocking a handful of Chinese models from the American market. The researchers contend the regulation is reorganizing sourcing decisions across the global auto supply base, from Tier 1 software suppliers down to component vendors.

The rule in question stems from a Commerce Department investigation launched in early 2024 under Section 301-era authorities covering information and communications technology and services — ICTS in the trade lexicon. The regulatory thrust is straightforward: restrict hardware and software from China and Russia in connected vehicles sold in the United States, on national security grounds.

For plant planners and purchasing chiefs, the stakes are concrete. Modern vehicles carry tens of millions of lines of code, and connectivity stacks now touch telematics units, infotainment platforms, over-the-air update systems and increasingly the driver-assistance layer. Any restriction on where that code and the underlying chips originate forces suppliers to requalify components, rewrite software contracts and, in some cases, stand up new production or verification capacity outside the affected countries.

Rhodium's framing — "rewires" rather than merely "restricts" — signals its core finding: the rule redirects trade flows rather than simply shrinking them. Suppliers with Chinese software or hardware exposure are, on this reading, rerouting development and sourcing toward third countries or toward U.S.-allied vendors to preserve access to the American market. That kind of rerouting has a well-worn precedent in the tariff era, and the auto sector has already lived through several rounds of it since 2018.

Trade-press readers should treat the specifics with the usual discipline. A consultancy analysis is a claim to verify against production data, not a confirmed sourcing decision by an OEM. The test will come in what automakers actually do: which suppliers win replacement contracts, which Chinese vendors lose design wins in U.S.-bound programs, and whether non-U.S. markets follow Washington's lead or split the global platform base into incompatible regional stacks.

The compliance timeline matters as much as the scope. Automakers work on multi-year program cycles, so any rule that touches software integration and electronic control units forces changes into platforms already locked for upcoming model years. Suppliers caught mid-cycle face the hardest choices: absorb requalification costs, exit the U.S. market, or restructure their own Tier 2 base.

There is also a second-order effect worth tracking. If the ICTS framework becomes the template — as tariffs did — for other advanced-economy markets, suppliers serving Europe, Japan and Korea will face parallel compliance demands. Rhodium's title suggests exactly that systemic view: the rule is less about any single vehicle program than about the architecture of the supply chain itself.

What to watch next: Commerce's implementation guidance and any enforcement actions against specific suppliers, OEM announcements of connectivity-stack requalifications in U.S. programs, and whether the EU or other regulators introduce comparable connected-vehicle security rules. Each of those decisions will determine whether Rhodium's "rewiring" thesis holds in the order books.